The npm commands you will type most are npm install to add packages, npm ci for clean installs in CI, npm update to move within your version ranges, npm uninstall to remove a package, and npm run followed by a script name. Search the full table below, then test what a caret or tilde range allows.
| Task | Command | Changes package.json? |
|---|---|---|
| Add a package | npm install react | Yes, adds it to dependencies |
| Add a dev tool | npm install -D vite | Yes, adds it to devDependencies |
| Install exactly what the lockfile says | npm ci | Never |
| Get newer versions inside your ranges | npm update | No, unless you pass --save |
| Remove a package | npm uninstall lodash | Yes, removes it |
Updated
Command lists online tend to stop at the name of each command. This one adds the flags people actually reach for, the aliases, what each command writes to package.json and the lockfile, and a range tester so you can see which versions a caret, tilde or x-range really accepts.
| Command | Group | What it does |
|---|---|---|
npm init -y | Set up | Create a package.json with default answers. |
npm install | Install | Install everything listed in package.json. Aliases include npm i and npm add. |
npm install <pkg> | Install | Add a package to dependencies and the lockfile; saving is on by default. |
npm install -D <pkg> | Install | Save to devDependencies (long form --save-dev). |
npm install -E <pkg> | Install | Save an exact version instead of a caret range (--save-exact). |
npm install -O <pkg> | Install | Save to optionalDependencies (--save-optional). |
npm install --no-save <pkg> | Install | Install without recording it in package.json. |
npm install -g <pkg> | Install | Install globally, into npm's prefix folder rather than the project. |
npm install --omit=dev | Install | Skip devDependencies, for example on a production server. |
npm install --legacy-peer-deps | Install | Ignore peer dependency conflicts the way older npm versions did. |
npm ci | Install | Clean install from the lockfile: deletes node_modules, never writes package.json or the lockfile. Alias npm clean-install. |
npm update | Update | Move packages to the newest versions their ranges allow. Aliases up and upgrade. |
npm update --save | Update | Same, and write the new versions back to package.json. |
npm update -g | Update | Update global packages to their latest tag. |
npm install <pkg>@latest | Update | Jump to the latest tag even across a major version. |
npm outdated | Update | Show Current, Wanted and Latest for each dependency. |
npm uninstall <pkg> | Remove | Remove a package and its entry in package.json and the lockfile. Aliases remove, rm, r, un and unlink. |
npm uninstall --no-save <pkg> | Remove | Remove the files but keep the entry in package.json. |
npm uninstall -g <pkg> | Remove | Remove a global package. |
npm run | Scripts | List every script in package.json. |
npm run dev | Scripts | Run the dev script, usually a dev server. |
npm run build -- --mode staging | Scripts | Pass flags after -- to the script instead of npm. |
npm run lint --if-present | Scripts | Do nothing, without failing, when the script does not exist. |
npm start | Scripts | Run the start script; also works for test, stop and restart without run. |
npm test | Scripts | Run pretest, test and posttest in order. |
npx <pkg> | Scripts | Run a package's binary without installing it globally. |
npm audit | Security | Ask the registry for known vulnerabilities in your dependency tree. |
npm audit fix | Security | Apply fixes that stay inside your declared ranges. |
npm audit fix --force | Security | Allow fixes outside your ranges, including major versions. Review the changes. |
npm audit --audit-level=high | Security | Exit with an error only for high or critical findings, handy in CI. |
npm ls | Inspect | Show the installed dependency tree. |
npm view <pkg> versions | Inspect | List published versions of a package. |
npm config get prefix | Inspect | Show the folder global packages install into. |
npm run test -w a | Workspaces | Run a script in one workspace (--workspace=a). |
npm run test --workspaces | Workspaces | Run a script in every workspace. |
Range ^1.2.3 expands to >=1.2.3 <2.0.0, so version 1.9.0 satisfies it.
| Range | Means | Allows |
|---|---|---|
| ^1.2.3 | >=1.2.3 <2.0.0 | Minor and patch updates |
| ^0.2.3 | >=0.2.3 <0.3.0 | Patch updates only |
| ^0.0.3 | >=0.0.3 <0.0.4 | Nothing newer |
| ~1.2.3 | >=1.2.3 <1.3.0 | Patch updates |
| ~1 | >=1.0.0 <2.0.0 | Same as 1.x |
| 1.2.x | >=1.2.0 <1.3.0 | Any patch of 1.2 |
| * | >=0.0.0 | Any version |
| 1.2.3 - 2.3.4 | >=1.2.3 <=2.3.4 | Inclusive span |
prebuild runs automatically before build. Local binaries such as vite resolve from node_modules/.bin.
{
"scripts": {
"dev": "vite",
"prebuild": "npm run lint",
"build": "vite build",
"preview": "vite preview",
"lint": "eslint .",
"test": "vitest run"
}
}Clean, repeatable install, a build, then a security gate that only fails on serious findings.
npm ci
npm run build
npm audit --omit=dev --audit-level=highUse npm install while developing. It adds packages, saves them to package.json by default and keeps the lockfile in step with what you asked for.
Use npm ci on build servers and in Docker images. It starts from an empty node_modules and treats the lockfile as the source of truth, so every build gets the same tree.
Use npm update when you want bug fixes without touching your declared ranges. Check npm outdated first so you know what will move.
Anything in the scripts object of package.json runs with npm run name. npm adds node_modules/.bin to the PATH for the script, which is why vite or next work there without a global install.
A script called prebuild runs before build and postbuild runs after it. test, start, stop and restart are special enough that you can skip the word run for them.
npm install resolves versions from package.json, may update the lockfile, and keeps the existing node_modules. npm ci needs a lockfile, deletes node_modules first, installs exactly what the lockfile lists, fails if it disagrees with package.json, and never writes either file.
Not by default. The npm docs list save as false for npm update, so only node_modules and the lockfile change. Pass --save if you want the new versions written back to package.json.
It allows any change that keeps the left-most non-zero number the same. ^1.2.3 accepts 1.x from 1.2.3 up but not 2.0.0. Below 1.0.0 it is stricter: ^0.2.3 only accepts 0.2.x patches.
Put -- before it, for example npm run dev -- --port 4000. Everything after the two dashes goes to the script instead of being read by npm.
Wanted is the highest version your package.json range allows. Latest is the version the package author tagged as latest on the registry. When Latest is higher than Wanted, getting it means editing the range.
Related: pnpm vs npm, Install Node.js and npm on Mac, Git cheat sheet, JSON formatter for package.json, Regex cheat sheet.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.